Overview

overview

10

Static

static

3

006f370d71...18.exe

windows7-x64

10

006f370d71...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 20:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    006f370d71f60e4f449565d64c67ab37_JaffaCakes118.exe

  • Size

    36KB

  • MD5

    006f370d71f60e4f449565d64c67ab37

  • SHA1

    247a478b05869606455f62f7e4fc9410684d0b54

  • SHA256

    97fa4860ddfd62eae525d2d021f026d85b361bf0f3220598a35b5f4c16db1ea8

  • SHA512

    620d7ab8d3407529a917daa27e16b36a88c3d4228011bfc74292cc97614ff6d328ab7943bbe4bce60610398fcf61b49fce533c083ee54df206b2bde9dcfbefe0

  • SSDEEP

    768:dCs1VT4DmmGWFW4ckEC9vpCnY9m6y+nHVNxo1HDDme:d1TClGi1cOVM3Axo1HDN

Score
10/10
modiloadertrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\006f370d71f60e4f449565d64c67ab37_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\006f370d71f60e4f449565d64c67ab37_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files\Common Files\Microsoft Shared\MSInfo\atmQQ2.dll
    Filesize

    25KB

    MD5

    4f295581caf2904699cdd4fced41c810

    SHA1

    98d1e85ea54d42d08bca6f78ceaa98b8ad947039

    SHA256

    e0aa03a2e84c19d1acdbd83f5ba3ed80aff9a3321ddd2ec9c2bf7ecf284f6c4a

    SHA512

    260a22f71df19ea650a11be59a6c5eb9b0f1196e57b3dae0d14c7ae9db56b837771380893b3ee1beaa9114dfed34664ec4210cd31d0bba19fbe74ded4da11eab

    Download Submit
  • memory/2040-0-0x0000000000400000-0x0000000000425000-memory.dmp
    Filesize

    148KB

    Download
  • memory/2040-5-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2040-4-0x0000000000220000-0x000000000023F000-memory.dmp
    Filesize

    124KB

    Download
  • memory/2040-6-0x0000000000400000-0x0000000000425000-memory.dmp
    Filesize

    148KB

    Download
  • memory/2040-7-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

    Download